indexQueue

indexQueue

noun

A queue in the data pipeline that holds events that have been parsed and need to be indexed.

Incoming data first goes into the parsingQueue. From there, it goes into the parsing pipeline, where it undergoes event processing. It then moves into the indexQueue and on to the indexing pipeline, where the Splunk software stores the events on disk.

Both parsing and indexing usually take place on the indexer. However, you can separate out the parsing stage, so that it occurs instead on a heavy forwarder.

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »